July 9, 2015 By Shane Schick 2 min read

Normally, we expect malware to disable older versions of key applications in order to steal information or take over a victim’s computer, but the latest in a string of problems involving Adobe Flash Player has cybercriminals offering a free update to the browser plugin instead.

As first revealed in a blog post by an independent security researcher known only as Kafeine on Malware don’t need Coffee, the latest version of the Kovter malware has been updating Flash as a sort of competitive tactic against other cybercriminals. The Kovter Trojan typically works by taking over a victim’s machine and clicking on online ads to generate revenue through crooked pay-per-click (PPC) affiliate programs.

In some respects, the real victims here may be advertisers, who don’t realize they’re getting impressions obtained by hijacking computers. As Naked Security noted, click-fraud malware can’t really work if it can’t see online ads properly, which is probably one of the reasons this variant of Kovter proactively updates Flash on the user’s behalf.

On the other hand, ensuring that a machine is using the latest version of the browser plugin could also be a way of guaranteeing rival click-fraud malware authors have a tougher time targeting the same computer later. Komando suggested this isn’t entirely a new tactic; earlier viruses could clean up a machine with their own antivirus tools before stealing information or taking control.

Perhaps the best defense strategy is beating Kovter to the punch by updating Flash first. There are certainly enough reasons by now: Just last week, The Guardian reported that a flaw in the plugin was allowing attackers to embed malware in a video file to take over victims’ computers. Around the same time, cybercriminals were taking advantage of the same flaw in drive-by download attacks using the Magnitude exploit kit.

Computerworld suggested malicious actors are getting much faster at seizing such opportunities, so users need to patch as quickly as possible. And as this latest incident involving Kovter proves, cybercriminals are becoming as interested in one-upping each other as they are using malware to steal data or make money.

More from

What is the Open-Source Software Security Initiative (OS3I)?

3 min read - The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy.After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security of…

Widespread exploitation of recently disclosed Ivanti vulnerabilities

6 min read - IBM X-Force has assisted several organizations in responding to successful compromises involving the Ivanti appliance vulnerabilities disclosed in January 2024. Analysis of these incidents has identified several Ivanti file modifications that align with current public reporting. Additionally, IBM researchers have observed specific attack techniques involving the theft of authentication token data not readily noted in current public sources. The blog details the results of this research to assist organizations in protecting against these threats. Key Findings: IBM research teams have…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today